Green CMS 2.x allows an authenticated user to inject arbitrary SQL through the 'cat' parameter in a GET request to index.php. The injection flaw maps to CWE-89 and enables attackers to read, modify or delete database records, thereby compromising confidentiality and integrity of the underlying data store.

Affected vendors include Greencms. The product Green CMS 2.x, all releases in the 2.x line, is vulnerable. No finer version granularity is provided.

The CVSS score of 7.1 denotes a high severity vulnerability, however the EPSS score below 1% indicates low current exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Because the attack requires authenticated access to admin functions, it is limited to users who can reach index.php with the m=admin, c=posts, a=index parameters, making it a network-based, authenticated exploitation vector. Defenders should prioritize applying a vendor fix and monitor for abnormal database activity.